CVE-2024-58018 is a vulnerability identified in the Linux kernel, specifically within the Nouveau driver's handling of the NVIDIA GPU's GSP (Graphics System Processor) command queue buffer. The issue arises in the function r535_gsp_cmdq_push(), which manages the queuing of RPC (Remote Procedure Call) requests to the GSP. The vulnerability is due to an incorrect calculation of the available space in the GSP cmdq buffer. The function prematurely assumes the available buffer pages as the range from the write pointer to the buffer size without properly accounting for buffer wrap-around. This miscalculation leads to an incorrect determination of how much data can be safely copied into the buffer. Consequently, it can overwrite the RPC request currently being processed by the GSP, causing data corruption. The corrupted RPC request results in the GSP hanging, effectively causing a denial of service (DoS) condition. The kernel logs indicate a warning and a stack trace pointing to the r535_gsp_msgq_wait() function, confirming the hang due to corrupted RPC requests. This vulnerability affects Linux kernel versions containing the Nouveau driver with the r535 GSP implementation, as indicated by the affected commit hashes. No public exploits are known at this time, and no CVSS score has been assigned yet. The issue is technical and specific to GPU command queue management, impacting systems using the Nouveau open-source driver for NVIDIA GPUs. The vulnerability can cause system instability or crashes when processing large RPC requests through the GSP cmdq buffer, potentially affecting GPU-accelerated workloads or virtual GPU environments relying on this driver.

For European organizations, the impact of CVE-2024-58018 primarily concerns systems running Linux with NVIDIA GPUs using the Nouveau driver, especially in environments where GPU acceleration is critical, such as data centers, cloud providers, research institutions, and enterprises relying on GPU virtualization or compute workloads. The vulnerability can lead to GPU hangs and kernel warnings, resulting in system instability or crashes. This can cause denial of service on affected machines, disrupting business operations, especially in high-availability or performance-sensitive environments. Organizations using virtual GPU setups or GPU-accelerated applications may experience degraded service or outages. Although no remote code execution or privilege escalation is indicated, the DoS impact can affect service continuity and reliability. The lack of known exploits reduces immediate risk, but the vulnerability should be addressed promptly to prevent potential exploitation or accidental system failures. The impact is more pronounced in sectors with heavy Linux and GPU usage, such as scientific computing, financial services, telecommunications, and cloud infrastructure providers within Europe.

1. Apply Kernel Updates: Monitor Linux kernel releases and apply patches that fix this vulnerability as soon as they become available. Since the issue is in the Nouveau driver, ensure the kernel version includes the corrected r535_gsp_cmdq_push() function logic. 2. Use Proprietary NVIDIA Drivers: Where feasible, consider using the official NVIDIA proprietary drivers instead of Nouveau, as this vulnerability is specific to the Nouveau driver implementation. 3. Limit Exposure: For critical systems, restrict access and usage of GPU resources to trusted workloads and users to minimize the risk of triggering the vulnerability. 4. Monitor System Logs: Implement monitoring for kernel warnings or GPU-related errors that may indicate attempts to exploit or accidental triggering of this vulnerability. 5. Test Updates in Staging: Before deploying kernel updates in production, test them in staging environments to ensure stability and compatibility with existing GPU workloads. 6. Coordinate with Vendors: Engage with Linux distribution maintainers and hardware vendors for timely updates and guidance. 7. Consider Workarounds: If immediate patching is not possible, consider disabling GPU acceleration features relying on the Nouveau driver or isolating affected systems until patched.